Extracted

• • Target
    Update.exe
  • Size 3.4MB
  • SHA256 0868c177ba1a4657b732cb6d06d05b5aed231b17931bd31701bdceda86f37f0e
  • MD5 18f0685f7697e94a51cbe5b1558ec28d
  • SHA1 d244974f4d34c4c53bce69b706098b5499aba517
  • SHA512 44ec76830be6f2b1b4b06b4463141383dd73b6a9a5c180e69ba85ce1f009967b226ecd2806cc34454b4aa3b9cfce39f9019278593f84f436e82142213ca2ddce
  • SSDEEP 98304:9F8nSYl3CG8TZ3wFvJ9i1BDoCKHUvSIk028T/:9FgJY7t3gCHUCK+SIkS
  • TLSH
    T13DF533668025C9DDD8F760350EC7712B20965CFBA636CD7BA03C667F44F2986A8533B2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverysalatstealerstealerupxcredential_accessdefense_evasionexecutionspywaretrojan

  • Detect SalatStealer payload

  • Family: salatstealer

    SalatStealer is a stealer that takes sceenshot written in Golang.

    stealersalatstealer

  • UAC bypass

    defense_evasiontrojan

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2